# Hash function security summary

This article summarizes publicly known attacks against cryptographic hash functions. Note that not all entries may be up to date. For a summary of other hash function parameters, see comparison of cryptographic hash functions.

## Common hash functions
### Collision resistance

| Hash function | Security claim | Best attack | Publish date | Comment |
| MD5 | 2$^{64}$ | 2$^{18}$ time | 2013-03-25 | This attack takes seconds on a regular PC. Two-block collisions in 2$^{18}$, single-block collisions in 2$^{41}$. |
| SHA-1 | 2$^{80}$ | 2$^{61.2}$ | 2020-01-08 | Paper by Gaëtan Leurent and Thomas Peyrin |
| SHA256 | 2$^{128}$ | 31 of 64 rounds (2$^{65.5}$) | 2013-05-28 | Two-block collision. |
| SHA512 | 2$^{256}$ | 24 of 80 rounds (2$^{32.5}$) | 2008-11-25 | Paper. |
| SHA-3 | Up to 2$^{512}$ | 6 of 24 rounds (2$^{50}$) | 2017 | Paper. |
| BLAKE2s | 2$^{128}$ | 2.5 of 10 rounds (2$^{112}$) | 2009-05-26 | Paper. |
| BLAKE2b | 2$^{256}$ | 2.5 of 12 rounds (2$^{224}$) | 2009-05-26 | Paper. |

### Chosen prefix collision attack

| Hash function | Security claim | Best attack | Publish date | Comment |
| MD5 | 2$^{64}$ | 2$^{39}$ | 2009-06-16 | This attack takes hours on a regular PC. |
| SHA-1 | 2$^{80}$ | 2$^{63.4}$ | 2020-01-08 | Paper by Gaëtan Leurent and Thomas Peyrin |
| SHA256 | 2$^{128}$ | | | |
| SHA512 | 2$^{256}$ | | | |
| SHA-3 | Up to 2$^{512}$ | | | |
| BLAKE2s | 2$^{128}$ | | | |
| BLAKE2b | 2$^{256}$ | | | |

### Preimage resistance

| Hash function | Security claim | Best attack | Publish date | Comment |
| MD5 | 2$^{128}$ | 2$^{123.4}$ | 2009-04-27 | Paper. |
| SHA-1 | 2$^{160}$ | 45 of 80 rounds | 2008-08-17 | Paper. |
| SHA256 | 2$^{256}$ | 43 of 64 rounds (2$^{254.9}$ time, 2$^6$ memory) | 2009-12-10 | Paper. |
| SHA512 | 2$^{512}$ | 46 of 80 rounds (2$^{511.5}$ time, 2$^6$ memory) | 2008-11-25 | Paper, updated version. |
| SHA-3 | Up to 2$^{512}$ | | | |
| BLAKE2s | 2$^{256}$ | 2.5 of 10 rounds (2$^{241}$) | 2009-05-26 | Paper. |
| BLAKE2b | 2$^{512}$ | 2.5 of 12 rounds (2$^{481}$) | 2009-05-26 | Paper. |

### Length extension

* Vulnerable: MD5, SHA1, SHA256, SHA512
* Not vulnerable: SHA384, SHA-3, BLAKE2

## Less-common hash functions
### Collision resistance

| Hash function | Security claim | Best attack | Publish date | Comment |
| GOST | 2$^{128}$ | 2$^{105}$ | 2008-08-18 | Paper. |
| HAVAL-128 | 2$^{64}$ | 2$^7$ | 2004-08-17 | Collisions originally reported in 2004, followed up by cryptanalysis paper in 2005. |
| MD2 | 2$^{64}$ | 2$^{63.3}$ time, 2$^{52}$ memory | 2009 | Slightly less computationally expensive than a birthday attack, but for practical purposes, memory requirements make it more expensive. |
| MD4 | 2$^{64}$ | 3 operations | 2007-03-22 | Finding collisions almost as fast as verifying them. |
| PANAMA | 2$^{128}$ | 2$^6$ | 2007-04-04 | Paper, improvement of an earlier theoretical attack from 2001. |
| RIPEMD (original) | 2$^{64}$ | 2$^{18}$ time | 2004-08-17 | Collisions originally reported in 2004, followed up by cryptanalysis paper in 2005. |
| RadioGatún | Up to 2$^{608}$ | 2$^{704}$ | 2008-12-04 | For a word size w between 1-64 bits, the hash provides a security claim of 2$^{9.5w}$. The attack can find a collision in 2$^{11w}$ time. |
| RIPEMD-160 | 2$^{80}$ | 48 of 80 rounds (2$^{51}$ time) | 2006 | Paper. |
| SHA-0 | 2$^{80}$ | 2$^{33.6}$ time | 2008-02-11 | Two-block collisions using boomerang attack. Attack takes estimated 1 hour on an average PC. |
| Streebog | 2$^{256}$ | 9.5 rounds of 12 (2$^{176}$ time, 2$^{128}$ memory) | 2013-09-10 | Rebound attack. |
| Whirlpool | 2$^{256}$ | 4.5 of 10 rounds (2$^{120}$ time) | 2009-02-24 | Rebound attack. |

### Preimage resistance

| Hash function | Security claim | Best attack | Publish date | Comment |
| GOST | 2$^{256}$ | 2$^{192}$ | 2008-08-18 | Paper. |
| MD2 | 2$^{128}$ | 2$^{73}$ time, 2$^{73}$ memory | 2008 | Paper. |
| MD4 | 2$^{128}$ | 2$^{102}$ time, 2$^{33}$ memory | 2008-02-10 | Paper. |
| RIPEMD (original) | 2$^{128}$ | 35 of 48 rounds | 2011 | Paper. |
| RIPEMD-128 | 2$^{128}$ | 35 of 64 rounds | 2011 | Paper. |
| RIPEMD-160 | 2$^{160}$ | 31 of 80 rounds | 2011 | Paper. |
| Streebog | 2$^{512}$ | 2$^{266}$ time, 2$^{259}$ data | 2014-08-29 | The paper presents two second-preimage attacks with variable data requirements. |
| Tiger | 2$^{192}$ | 2$^{188.8}$ time, 2$^8$ memory | 2010-12-06 | Paper. |

## Attacks on hashed passwords

Hashes described here are designed for fast computation and have roughly similar speeds. Because most users typically choose short passwords formed in predictable ways, passwords can often be recovered from their hashed value if a fast hash is used. Searches on the order of 100 billion tests per second are possible with high-end graphics processors.
Special hashes called key derivation functions have been created to slow brute force searches. These include pbkdf2, bcrypt, scrypt, argon2, and balloon.